Is it possible to fully encrypt an iPhone? What cipher does it use and are there any weaknesses?
How can I protect my valuable data, such as email, when my iPhone gets stolen?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
iOS4 has introduced (a somewhat secure) Full Disk encryption for the iPhone. The encryption itself is done by hardware and uses AES-256 to encrypt your data.
An iPhone has two partitions:
The user data part gets encrypted with an AES-256 if enabled. The key for this is a passcode you must enter every time you want to unlock your phone. This ensures the data partition cannot be decrypted in an easy way. So if your phone gets stolen and the attacker doesn't have the passcode, he can't access your personal data.
The problem here is that's what Apple is telling us. There is a VERY BIG BUT that's following now.
Security researchers found out that the all of this security can be bypassed by a device that speaks the Apple control protocol. Also there seems to be a problem that all of this can be bypassed if you are able to Jailbreak the phone. The problem with this option is that the iPhone itself needs to be paired prior to a computer prior to be able to do the Jailbreak (if there is a way to bypass this please leave a comment). When the phone is Jailbroken an attacker can install an SSH daemon and just take a raw copy of all your data...unencrypted now.
If the above is fixed by Apple, you would have a reasonble secure device. So to protect your data you will need some extra apps that allow you to remotely whipe your iPhone and secure your emails safely.
Now besides all that is also nice to note that Apple has provided a complete Security API for developers. They can use it to produce Apps that can securely encrypt just about anything. Unfortunately, there are few Apps using it.
This are just some features and there are probably a lot more, so please feel free to share the knowledge and correct me if I'm wrong.
The problem here is that if you base your data security on the apple monolithic architecture (which is a good start) then you will be at risk when that architecture fails.
So the question you have to ask yourself is: "What happens when the device is jailbroken?"
A defence in depth approach would be to use Apple's APIs, but also to add your own independent layer. This of course would be based on your risk assessment of the data you store on the device.
Just in case.